Webhook Security

< 1 min read

Table of Contents

Verifying Webhook Signatures

Each webhook endpoint has a unique secret for signature verification. Validate incoming webhooks using HMAC-SHA256.

Verifying Webhook Signatures #

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(payload))
    .digest('hex');
  
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}